# CVEs published 2023-12-23

12 CVEs were published on December 23, 2023: 1 critical, 4 high. Days are UTC.

- [CVE-2023-7090](https://cve.now/CVE-2023-7090.md): Sudo: improper handling of ipa\_hostname leads to privilege mismanagement (CVSS 6.6, sudo · Red Hat Enterprise Linux +1)
- [CVE-2023-49594](https://cve.now/CVE-2023-49594.md): An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. (CVSS 4.5, instipod DuoUniversalKeycloakAuthenticator)
- [CVE-2016-15036](https://cve.now/CVE-2016-15036.md): Deis Workflow Manager race condition (CVSS 4.6, Deis Workflow Manager · github.com/deis/workflow-manager)
- [CVE-2014-125108](https://cve.now/CVE-2014-125108.md): w3c online-spellchecker-py spellchecker cross site scripting (CVSS 3.1, w3c online-spellchecker-py)
- [CVE-2023-7008](https://cve.now/CVE-2023-7008.md): Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes (CVSS 5.9, Red Hat Enterprise Linux · Red Hat Cryostat)
- [CVE-2020-36769](https://cve.now/CVE-2020-36769.md): Widget Settings Importer/Exporter Plugin \<= 1.5.3 - Unauthorized Widget Import to Stored Cross-Site Scripting (CVSS 7.4, kevinlangleyjr Widget Settings Importer/Exporter)
- [CVE-2023-6744](https://cve.now/CVE-2023-6744.md): Divi \<= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Elegant Themes Divi)
- [CVE-2023-5962](https://cve.now/CVE-2023-5962.md): ioLogik E1200 Series: Weak Cryptographic Algorithm Vulnerability (CVSS 6.5, Moxa ioLogik E1200 Series)
- [CVE-2023-5961](https://cve.now/CVE-2023-5961.md): ioLogik E1200 Series: Cross-Site Request Forgery (CSRF) Vulnerability (CVSS 8.8, Moxa ioLogik E1200 Series)
- [CVE-2023-7002](https://cve.now/CVE-2023-7002.md): Backup Migration \<= 1.3.9 - Authenticated (Admin+) OS Command Injection via url (CVSS 7.2, inisev BackupBliss – Backup & Migration with Free Cloud Sto…)
- [CVE-2023-6971](https://cve.now/CVE-2023-6971.md): The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP heade (CVSS 8.1, migrate Backup Migration)
- [CVE-2023-6972](https://cve.now/CVE-2023-6972.md): Backup Migration \<= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion (CVSS 9.8, inisev BackupBliss – Backup & Migration with Free Cloud Sto…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.